Methods, Devices and Systems for Securing Wireless Systems from Insider Information Attacks

1 . A method, comprising:

by operation of a first wireless device

receiving wireless messages from a wireless network,

determining that a received wireless message is a disconnect message directing the first wireless device to end communications over the wireless network,

determining that the received disconnect message is not valid in response to

decrypting at least a portion of the received disconnect message, and failing to find a shared secret value previously established during a network joining operation of the first wireless device, or

after transmitting a query message addressed to at least a source address of the received disconnect message, receiving more response messages than expected, and

ignoring the received disconnect message if it is determined to be not valid.

2 . The method of claim 1 , wherein the received disconnect message comprises a disassociation or deauthentication frame compatible with at least one IEEE 802.11 wireless standard.

3 . The method of claim 2 , wherein the query message is selected from the group of:

a block acknowledgement request, a power savings poll message, and a null data frame.

4 . The method of claim 1 , further including:

by operation of the first wireless device, executing the network joining operation, comprising exchanging messages with a second wireless device to

establish encryption operations for wireless messages on the wireless network, and

establish at least the shared secret.

5 . The method of claim 4 , wherein the network joining operation comprises an association operation compatible with at least one IEEE 802.11 wireless standard.

6 . The method of claim 4 , further including:

the first wireless device comprises a first access point device (AP) compatible with at least one IEEE 802.11 wireless standard that is part of a distributed system; and

by operation of the first wireless device, transmitting at least the shared secret in an encrypted message to a second AP of the distributed system.

7 . The method of claim 1 , further including:

the first wireless device comprises an access point device (AP) compatible with at least one IEEE 802.11 wireless standard that is part of a distributed system (DS);

by operation of the first wireless device,

generating and storing secure session data for a station device (STA) during association with the STA, secure session data including at least a device address of the STA and a corresponding shared secret that is shared with the STA,

receiving and storing secure session data for at least one other STA associated with at last one other AP of the DS,

in response to receiving a reassociation request having a device address of stored session data, decrypting the reassociation request, and

executing a reassociation operation request if the decrypted reassociation request includes at least the corresponding shared secret, and

ignoring the reassociation request if the decrypted reassociation request does not include at least the corresponding shared secret.

8 . The method of claim 1 , further including:

the first wireless device comprises an access point device (AP) compatible with at least one IEEE 802.11 wireless standard that is part of a distributed system (DS);

by operation of the first wireless device,

generating and storing secure session data for a station device (STA) during association with the STA, secure session data including at least a device address of the STA and a corresponding shared secret with the STA,

receiving and storing secure session data for at least one other STA associated with at least one other AP of the DS,

in response to receiving a reassociation request having a device address of stored session data,

decrypting the reassociation request and executing a reassociation operation, and

dropping packets for transmission to the reassociated STA for a predetermined timeout period if the decrypted reassociation request does not include at least the shared secret.

9 . A device, comprising:

wireless circuits configured to receive and transmit wireless messages according to at least one wireless standard; and

processor circuits configured to

determine that a received wireless message is a disconnect message directing the device to end communications over the wireless network,

determine that the received disconnect message is not valid in response to

decrypting at least a portion of the received disconnect message, and failing to find a shared secret value previously established during a network joining operation of the first wireless device, or

after transmitting a query message addressed to at least a source address of the received disconnect message, receiving more response messages than expected, and

ignoring the received disconnect message if it is determined to be not valid.

10 . The device of claim 9 , wherein:

the wireless circuits are compatible with at least one IEEE 802.11 wireless standard; and

the received disconnect message comprises a disassociation or deauthentication message.

11 . The device of claim 9 , wherein:

the wireless circuits are compatible with at least one IEEE 802.11 wireless standard; and

the query message is selected from the group of: a block acknowledgement request, a power savings poll message and a null data frame.

12 . The device of claim 9 , wherein:

the processor circuits are further configured to execute the network joining operation comprising

exchanging messages with another wireless device to establish encryption operations for wireless messages on the wireless network, and

establishing at least the shared secret.

13 . The device of claim 12 , wherein:

the wireless circuits are compatible with at least one IEEE 802.11 wireless standard; and

the network joining operation comprises an association operation.

14 . The device of claim 9 , wherein:

the processor circuits are further configured to

transmit at least the shared secret in an encrypted message to another device of the wireless network; and

receive shared secrets corresponding to other wireless devices of the wireless network.

15 . A system, comprising:

a first wireless device configured to

execute network joining operations to enable joining wireless devices to access a wireless network, the network joining operation establishing secure session data for the joining wireless devices that includes at least

device identification values (IDs) of the joining wireless devices, and

shared secret values with the joining wireless devices,

execute identity check operations in response to receiving a network joining request having a device ID of the secure session data, the identity check operations comprising

decrypting the network joining request,

in response to the decrypted network joining message not including the shared secret value,

ignoring the network joining message, or

executing a network joining operation with a wireless device issuing the network joining message but dropping any wireless messages for transmission to the device ID for a predetermined timeout period.

16 . The system of claim 15 , wherein:

the wireless network is compatible with at least one IEEE 802.11 wireless standard;

the network joining operations comprise association operations;

the device ID comprises a media access control (MAC) address; and

the network joining message comprises an association request or reassociation request.

17 . The system of claim 15 , further including:

a second wireless device configured to transmit additional secure session data to the first wireless device, the additional secure session data comprising device IDs and shared secret values of other joining wireless devices that have executed network joining operations with the second wireless device; and

the first wireless device is further configured to

transmit its secure session data to the second wireless device, and

execute the identity check operations in response to receiving a network joining request having a device ID of the secure session data or additional secure session data.

18 . The system of claim 17 , wherein:

the wireless network is compatible with at least one IEEE 802.11 wireless standard;

the first wireless device and second wireless devices comprise access point devices of a same distributed system;

the secure session data for the first wireless device corresponds to station devices (STAs) associated with the first wireless device; and

the additional secure session data corresponds to STAs associated with the second wireless device.

19 . The system of claim 15 , further including:

at least one joining wireless device configured to execute message check operations in response to receiving a disconnect message directing the joining wireless device to stop communications on the wireless network, the message check operations comprising

decrypting the received disconnect message,

in response to the decrypted disconnect message including a shared secret value of the joining device, executing actions directed by the disconnect message, and

in response to the decrypted disconnect message not including the shared secret value of the joining device, ignoring the disconnect message.

20 . The system of claim 17 , further including:

at least one joining wireless device configured to execute message check operations in response to receiving a disconnect message directing the joining wireless device to stop communications on the wireless network, the message check operations comprising

transmitting a query message to a device address corresponding to the disconnect message,

in response to receiving more responses than expected to the query message, ignoring the disconnect message.